Last updated 15 November 2026
Privacy policy
Hourgrain is a food diary and weight log, so what you put in it is health information. This page says what we hold, why, who helps us run the service, and how long anything is kept. The short version: Hourgrain is paid for by the people who use it, there are no ads and no tracking, and nothing you log is ever sold.
Who is responsible
Hourgrain is made by Oshan Mudannayake, based in Sri Lanka, who trades as Latenari. Latenari is a trading name, not a registered company. When this page says "we", it means him. He decides how your data is used and is responsible for it.
Questions, requests and complaints go to [email protected]. A person reads every message.
What we hold
| What | Why | How long |
|---|---|---|
| Your email address, and the sign-in methods you use | To sign you in and to send sign-in codes | Until you delete your account |
| Apple sign-in refresh credential | Encrypted separately on the server to attempt removal of Apple access when you delete your account; never included in device sync, exports or assistant access | Until replaced or you delete your account. Authorization codes and access tokens are used transiently. |
| Sign-in codes | Stored only as a scrambled hash, so we can check the code you type | Each code works for 15 minutes; the record is removed after a day |
| AI usage records, when AI is enabled: task type, model, token counts, status and estimated cost, with no photo, prompt or answer | To apply the monthly allowance and understand reliability and cost | Individual records for 90 days or until account deletion. Monthly allowance totals for the current UTC month and previous three months; a deleted member leaves only aggregate household counts, and deleting the sponsor deletes that allowance bucket |
| Your profile: sex, year or date of birth, height, activity level, starting weight, and your plan settings | To estimate your starting expenditure and set your targets | Until you delete your account |
| Trial and Premium access status, when enabled: when access ends and whether this account has already used Premium | To provide the trial and paid features, prevent repeat trials and apply household coverage | Account-linked trial and access state until you delete your account |
| Web subscription purchase records: plan, checkout, transaction, customer and subscription references, status, paid-through date, cancellation and refund state | To verify web payments, provide paid access and household coverage, manage subscriptions and prevent payment replay or misuse | Account-linked access records until account deletion. Checkout/payment references and deduplicated event records remain without an Hourgrain account or health-data link to prevent replay. Paddle retains its own financial records under its policies; Hourgrain does not retain webhook payloads or payment-card details. |
| Native subscription purchase records: store, plan, checkout identifier, purchase reference, status, paid-through date and renewal or cancellation state | To verify purchases, restore paid access, apply household coverage and prevent purchase replay or misuse | Account-linked access records until account deletion. Checkout and payment references and event records remain without an Hourgrain account or health-data link to prevent replay. Apple and Google keep their own records under their policies. |
| Your diary: foods, amounts, times, notes and day status | This is the product | Until you delete it or your account |
| Weigh-ins, body fat and body measurements you record. With your permission, the phone imports weight and body fat from Apple Health or Health Connect into your weigh-ins and writes logged nutrition and typed weigh-ins back to that platform. | To show your progress and work out your weight trend and real expenditure | Until you delete them or your account |
| Today's step count from Apple Health or Health Connect, when you allow it | Shown on Progress on this device only; never sent to us or used to change your calorie target | The latest reading replaces the previous one; the cached count is cleared when you sign out |
| Your library: foods and recipes you create, the batches you cook (what went into the pot and what it weighed cooked), the pots you weigh with and what they weigh empty, and barcodes you save | So you can log them again quickly | Until you delete them or your account |
| Reports you make that a food is wrong: which food and barcode, what is wrong, your note, the numbers it had then, and the correction you saved, if any | So we can fix Hourgrain's food data, or a product's record, for everyone | Until we've reviewed it, or you delete your account |
| Your household, if you join one: who is in it, and whether others may log for you | To share foods and, if you allow it, let family log meals for you | Until you leave the household or delete your account |
| Signed-in devices, access tokens and connected assistants: a name for each, what an assistant may do, when it was made and last used | So you can see where you are signed in and what can reach your account, and revoke access | Until the session, token or connection ends or is revoked (a disconnected assistant's record goes 30 days later), or you delete your account |
| The answer to a request an app may retry (an invite, a new access token, what a photo or description was read as), stored encrypted so the server can return it to an authorized, matching retry | So a retry after a dropped connection gets the same answer instead of a second invite, token or reading | 24 hours, or until you delete your account |
| Your latest visual body-fat estimate, with its date and illustration reference, if you enter one | To display your own rough estimate and sync it across devices; separate from scale readings, with no effect on calorie or macro targets. | Until you replace or remove it, delete measurements, or delete your account |
| Progress photos, when storage is enabled | Your private front, side and back history; never shared with household members or sent to AI | Until you delete the photo or your account. Failed erasures are retried. Abandoned uploads are removed after 15 minutes. No versions or soft-delete copies. You can export the saved photos. |
| Meal photos, when storage is enabled | To read the meal and let you read it again | Access ends seven days after upload reservation; expired copies are removed by background cleanup, with retries during storage outages. Delete after reading removes the stored copy before reading. Abandoned uploads expire after 15 minutes. Account deletion erases all stored meal photos before succeeding. No permanent keep, versions or soft-delete copies |
| Background export files and request metadata, when configured | To build the export you request and optionally email its download link | Links work for 24 hours. Expired request records and files are removed on subsequent cleanup; the private bucket has a one-day lifecycle backstop. A link can be used without signing in, so anyone you give it to can download the file until it expires |
| Server logs: your IP address, the address requested, errors | To keep the service running and secure | About 30 days. Logs never hold what you eat or weigh |
| The beta waitlist: your email address and which form you used | To invite you to the beta | Until we send your beta invite, and never more than 12 months after you joined; sooner if you ask |
The apps also keep a copy of your diary on your phone or in your browser, so Hourgrain opens instantly and you can log without a connection. Signing out or clearing it from Settings removes that copy.
What we don't collect
- No advertising, and no advertising identifiers. There are no ads on any plan, and there never will be.
- No advertising or general-purpose tracking tools in Hourgrain, and no cookies on this website.
- No location, contacts or device fingerprints.
- Nothing you log is sold, rented or shared for marketing.
How we use it
Only to run Hourgrain for you: to show your diary, work out your weight trend and expenditure, set your targets, sync between your devices, share with the household you choose, and send you sign-in codes. We also count, across all accounts, how many people signed up, logged a food in a week and were still logging a month later, so we can tell whether Hourgrain is working; those counts are totals that hold nobody's name, diary or weight. We don't read your diary. Without your say-so, nobody looks at it, unless the law requires it or we need to investigate abuse of the service.
Where the law asks for a legal basis, we rely on your explicit consent for your health information (you give it when you sign up, and you can withdraw it by deleting your account), and on running the service you asked for for the rest.
Photo and describe
When enabled, photo and describe features read a meal photo, a nutrition label or a description you type. When you press Analyze, that photo or text, with the names of foods that help it match, is sent to Google Cloud Vertex AI (turn off “Use my foods as context” on the phone, or “Prefer your own foods” on the web, and no food names go with it) to read, for that one request. Google does not train or fine-tune its models on this data without permission or instruction, and, when meal-photo storage is enabled, Hourgrain keeps a private meal-photo copy for seven days so you can read it again. Choose Delete after reading in Privacy to remove the stored copy before reading, including failed readings. That setting also removes older saved meal photos when it syncs. Re-analysis does not extend the seven days. Recipe and label photos are not stored. Nothing is sent unless you press Analyze.
Vertex AI uses a global endpoint, so AI processing can take place outside Singapore even though Hourgrain's own storage is in Singapore. This does not mean zero provider retention: default project-scoped caches can retain inputs, outputs and derived data for up to 24 hours, including supported durable derived cache state. Google's abuse monitoring may log suspicious requests for authorized review and retain them for up to 90 days under the applicable account terms. Hourgrain has not established a cache disablement or monitoring exemption. Deleting a saved photo in Hourgrain does not delete provider caches or retention. No search or Maps grounding is used. See Google's data governance and abuse monitoring details.
When you import a recipe from a link, our server opens that page to read the recipe from it and keeps neither the link nor the page. Most recipe pages carry the recipe as structured data, which is read without AI; for one that doesn't, and only once AI is switched on, the page's text goes to Google Cloud Vertex AI for that one request. Nothing is saved until you save the recipe yourself.
On the phone you can also choose a recipe-card or cookbook-page photo. You see a preview before pressing Read photo. Only that image goes to Google Cloud Vertex AI to read the recipe, once AI is switched on. The phone resizes it and removes its metadata before upload. Hourgrain does not keep the image, and you check the ingredients and their quantities before saving the recipe.
iPhone home widget
If you add the iPhone home widget, Hourgrain shares only your saved energy and protein budget text, diary date, language and expiry with its widget extension through a private on-device container. It shares no account identity, credentials, diary rows, photos or body measurements through this feature, and ordinary widget refreshes send no data to Google or Siri. The budget text supports the system's sensitive-content redaction.
Open Hourgrain after adding the widget and to refresh it. The timeline replaces expired numbers with an Open app prompt at the next diary-day boundary; iOS controls when rendered views update. Invalid or expired stored copies are removed on the next access. Signing out clears the snapshot; removing the last widget clears it on the next app refresh unless Siri budget answers remain enabled. A previously rendered system copy can remain until iOS updates it.
Siri shortcuts and saved-budget replies
On iPhone, Siri shortcuts can open Log food or prepare water, calories or weight for review in Hourgrain. Apple receives amounts you supply when you invoke those shortcuts. Nothing is recorded until you save in the app. Apple may extract anonymized static shortcut phrases, titles and descriptions to improve App Shortcuts; that metadata contains no diary data.
Spoken budget answers in Siri is a separate choice in Privacy, off by default and independent of the Google Assistant choice. If enabled, Siri can read only your unexpired saved date and energy/protein budget after local device authentication. It performs no fresh diary or Health lookup. Open Hourgrain to refresh. Turning it off removes speech and any copy kept only for speech on the next app update; a home widget can keep its display copy. Sign-out clears the cache, and changes on another device apply after sync. Replies already handed to Apple may finish and cannot be retracted. Apple handles requests and replies under its policies. This choice controls saved-budget replies, not all Siri requests you explicitly invoke. Availability depends on Siri support.
Android widgets and spoken budget answers
The Android home widget shows a saved date and your remaining calorie or energy and protein budget. Android widget hosts you select can display it, including Google Assistant when you ask to show the widget. The separate spoken budget feature is off by default. If you enable Spoken budget answers in Privacy, Google Assistant can receive that dated budget text to display and speak when its budget widget is in use. It receives no diary rows, names, notes, photos, body measurements or Hourgrain credentials through this feature. Google's Widgets Extension library may collect client-app metadata for adoption, version and feature use. Google handles the response under its own policies.
Open Hourgrain to refresh the snapshot. The copy on your phone expires at the next diary-day boundary and is removed on the next refresh or render. Turning spoken answers off removes the speech text and any cache kept only for that feature; an independently added home widget keeps its display snapshot. Signing out clears both. Changes from another device take effect after this phone syncs. A reply already given to the system or Google can finish and cannot be retracted by clearing the phone's cache. Availability depends on Google Assistant support.
Who helps us run it
The companies below run Hourgrain or provide features you choose. Our hosting and AI providers process data under their service terms. Siri, Google Assistant and Google’s barcode library handle the requests or diagnostic metadata described below under their own policies.
| Who | For | What they handle | Where |
|---|---|---|---|
| Paddle (web subscriptions) | Selling and processing optional web subscriptions as merchant of record | Selected price, random checkout identifier and app/environment metadata from Hourgrain; buyer contact, billing and payment details you enter in Paddle checkout. No diary, photos or health data. | Under Paddle's privacy notice |
| Apple and Google (native subscriptions) | Processing optional subscription payments and purchase verification | A random account-bound checkout identifier and store purchase references; no diary, photos or health data. The store handles payment details under its own policies. | Under the store's service policies |
| Google Cloud | Running the Hourgrain service, private photo/export storage, secrets and logs | Everything the service handles, encrypted at rest | Singapore for Hourgrain hosting and storage; Vertex AI is listed separately below |
| Neon | The database | Account, diary, library and settings records, and processing metadata. Photo and export-file bytes stay in Google Cloud Storage | Singapore (on Amazon Web Services) |
| Resend | Sending sign-in codes | Your email address and the message | Japan (on Amazon Web Services) |
| Cloudflare | This website, the beta waitlist, and forwarding mail sent to hourgrain.com | Waitlist addresses; visitors' IP addresses in Cloudflare's own logs; messages you send us | Worldwide |
| Google Cloud Vertex AI | Reading meal, label and recipe photos, descriptions and recipe pages without structured recipe data, only when you request it | The photo or text you send, or the recipe page text; provider caches and abuse monitoring may apply | Global processing, not confined to Singapore |
| Open Food Facts | Looking up a barcode you scan | The barcode number only, sent from our server and never linked to you | France |
| Siri (iPhone, optional) | Explicit shortcut requests and saved-budget replies you allow in Privacy | Amounts you supply, or the saved date and energy/protein budget text. Apple may extract anonymized static shortcut phrases and descriptions; no diary data is in that metadata | Under Apple’s service policies |
| Google Assistant (Android, optional) | Spoken budget answers you allow in Privacy | Saved date and energy/protein budget text; client-app metadata for the Widgets Extension library's adoption, version and feature use. Google handles responses under its policies | Under Google's service policies |
| Google (ML Kit, in the Android app) | Reading barcodes on your phone | Your phone's make, model and system version, the app's version and an identifier for this installation, for Google's diagnostics. The camera image and the barcode stay on your phone | Worldwide |
| Google (Gmail) | The support mailbox | Messages you send us | Worldwide |
When Apple or Google sign-in is enabled, the sign-in and account controls load that provider's sign-in script. The provider receives your browser's connection information and the sign-in request; your food diary, weight and photos are not sent to it.
When you delete your account, Hourgrain attempts to remove Apple access using its saved encrypted credential. Missing older credentials, unavailable keys or an Apple service failure do not stop local account deletion. If you used Apple sign-in, remove Hourgrain in your Apple Account settings if it is still connected after deletion. Turning off Apple sign-in inside Hourgrain only disables that sign-in method.
For optional web subscriptions, Paddle handles checkout on a separate payment-only website. Hourgrain sends the selected price and a random checkout identifier with app/environment metadata, without your email, diary, photos or health records. You provide buyer and payment details directly to Paddle. Hourgrain receives verified subscription, payment, cancellation and refund state to provide access. Deleting your Hourgrain account immediately cancels its recurring web subscription and unpaid web checkout; if Paddle cannot confirm cancellation, deletion waits for you to retry. Paddle keeps its own financial records under its policies.
For optional native subscriptions, Apple or Google handles the payment and receives a random purchase identifier that Hourgrain binds to your login. Hourgrain verifies the purchase and its current subscription period with the store. We do not receive your payment-card details, and your diary, photos and health records are not sent for billing. Google purchase tokens are used transiently for verification; Hourgrain stores their hashes rather than the original tokens. Deleting your Hourgrain account does not cancel an App Store or Play subscription; cancel it in that store.
Because these providers are outside your country, your data is transferred abroad. We use providers who commit to protecting it to the standard of the laws that apply, including standard contractual clauses where they are needed.
Who else sees it
Only the people you choose. Members of your household see the foods and pots you share with them, and, if you turn it on, can log meals into your diary and bring your past entries of their foods up to date when they correct them. A batch you share shows them how much of it is left, which counts the portions everyone in the household has logged from it, without saying who ate what. A food you mark as public can be found by other Hourgrain users, with the name on your profile beside it. When you report a food as wrong, we read the report to fix the food's record; nobody else sees it, and fixing a record never shows who reported it. We disclose data to authorities only when the law requires it, and we'll tell you if we're allowed to.
Deleting your data
You can delete entries, weigh-ins and foods at any time, and delete your whole account from Settings in the app or on the web. Deleting your account removes it from the live database at once: your diary, weigh-ins, library, sessions and tokens go together. Foods and batches you shared with your household stay with them, handed to another member; the phone app also lets you delete them instead.
Account deletion also erases stored meal and progress photos before succeeding; if storage erasure fails, the account stays available for retry.
Copies of the database kept for recovery from mistakes are themselves deleted within 30 days, so your data leaves them by then.
Your rights
Wherever you live, you can:
- Get a copy of everything we hold. Settings, Your data, exports it as a spreadsheet, as JSON or as a full ZIP, any time and on any plan.
- Correct it, in the app, or by asking us.
- Delete it, in the app, or by asking us.
- Withdraw your consent, by deleting your account.
- Object or ask questions, by writing to [email protected]. We answer within 30 days, usually much sooner.
- Complain to a regulator, such as the Data Protection Authority of Sri Lanka or the data protection authority where you live.
If you live in the United States, our consumer health data notice describes your rights over your health data in more detail.
iPhone backups
The Hourgrain iPhone app requests that iOS exclude Hourgrain's on-device health data and saved budget from device backups. Synced records can be downloaded again after sign-in. Changes made offline that have not reached the server may be lost if the phone is lost or erased, so do not rely on a device backup to recover them. iOS controls backup and restore behavior; this request is not a guarantee that no copy appears in a backup or restored device, and it does not remove older backup copies.
Security
Everything travels over encrypted connections, and our providers encrypt it at rest. Sign-in codes, session tokens and access tokens are stored only as hashes. Your diary is not end-to-end encrypted, because the server has to read your logs to work out your expenditure. If a breach ever affects your data, we'll tell you and the authorities as the law requires.
Age
Hourgrain is for people aged 18 and over. We don't knowingly hold data about anyone younger, and we delete it if we find we do.
Changes
If we change this policy in a way that matters, we'll tell you in the app or by email before the change applies. The date at the top always shows the latest version.